Review the CVE scan workflow #21252
Description
What would you like to be added?
Recently there is a glibc CVE https://nvd.nist.gov/vuln/detail/CVE-2026-0861.
It is an OS-level CVE in glibc rather than a Go runtime issue. etcd is built with CGO disabled, so it does not depend on glibc at runtime. It comes from the container base image. Upgrading the base image is recommended, but the etcd binary itself is not affected by this CVE.
But the problem is why our CVE scan workflow did not detect this?
Why is this needed?
to guarantee security and avoid CVE noise